A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device.
UniFi Protect AI Key (Version 2.2.6 and earlier)
Update your UniFi Protect AI Key to Version 2.2.8 or later.
CVSS Severity and Metrics:
Base Score: 5.3 Medium
CVSS : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE : CVE-2026-110454 (Andy Gill, ZephrSec Ltd)
Note: This CVE can be chained with other vulnerabilities
A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device.
UniFi Protect AI Key (Version 2.2.6 and earlier)
Update your UniFi Protect AI Key to Version 2.2.8 or later.
CVSS Severity and Metrics:
CVSS : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE : CVE-2026-110455 (Andy Gill, ZephrSec Ltd)
Note: This CVE can be chained with other vulnerabilities
A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device.
UniFi Protect AI Key (Version 2.2.6 and earlier)
Update your UniFi Protect AI Key to Version 2.2.8 or later.
CVSS Severity and Metrics:
Base Score: 5.3 Medium
CVSS : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE : CVE-2026-110456 (Andy Gill, ZephrSec Ltd)
Note: This CVE can be chained with other vulnerabilities
A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain information files on the device.
UniFi Protect AI Key (Version 2.2.6 and earlier)
Update your UniFi Protect AI Key to Version 2.2.8 or later.
CVSS Severity and Metrics:
CVSS : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE : CVE-2026-110457 (Andy Gill, ZephrSec Ltd)
Note: This CVE can be chained with other vulnerabilities
A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or truncate files on the device.
UniFi Protect AI Key (Version 2.2.6 and earlier)
Update your UniFi Protect AI Key to Version 2.2.8 or later.
CVSS Severity and Metrics:
CVSS : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE : CVE-2026-110458 (Andy Gill, ZephrSec Ltd)
Note: This CVE can be chained with other vulnerabilities
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service (DoS) attack on the device.
UniFi Protect AI Key (Version 2.2.6 and earlier)
Update your UniFi Protect AI Key to Version 2.2.8 or later.
CVSS Severity and Metrics:
CVSS : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CVE : CVE-2026-110459 (Andy Gill, ZephrSec Ltd)
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
